2

I am trying to integrate squid as a web proxy for my users in active directory. I have followed the tutorial in the squid site in here. When i run the command :

msktutil -c -b "CN=Administrator" -s HTTP/proxy.example.com -k /etc/squid3/PROXY.keytab \
--computer-name SQUIDPROXY-K --upn HTTP/proxy.example.com --server acdc.example.com --enctypes 28 --verbose

i got the error :

SASL/GSSAPI authentication started  
Error: ldap_sasl_interactive_bind_s failed (Local error)  
        additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Server not found in Kerberos database)  
Error: ldap_connect failed.

The file /etc/squid3/PROXY.tab is not populated neither. I have searched all over the internet but i cant find anything about this problem.

Here are my config files :

/etc/krb5.conf

[logging]
default = FILE
kdc = FILE
admin_server = FILE

[libdefaults]
    default_realm = DOMAIN.COM
    dns_lookup_kdc = no
    dns_lookup_realm = no
    ticket_lifetime = 24h
    default_keytab_name = /etc/squid3/PROXY.keytab



; for Windows 2008 with AES
;      default_tgs_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5
;      default_tkt_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5
;      permitted_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5



[realms]
DOMAIN.COM = {
   default_domain = domain.com
   kdc = acdc.domain.com
   kdc = acdc2.domain.com
   admin_server = acdc.domain.com
}

[domain_realm]
        .domain.com = DOMAIN.COM
        domain.com = DOMAIN.COM

Here is the error output:

     -- init_password: Wiping the computer password structure
 -- generate_new_password: Generating a new, random password for the computer account
 -- generate_new_password:  Characters read from /dev/urandom = 84
 -- create_fake_krb5_conf: Created a fake krb5.conf file: /tmp/.msktkrb5.conf-RoP6Kh
 -- reload: Reloading Kerberos Context
 -- finalize_exec: SAM Account Name is: SQUIDPROXY-K$
 -- try_machine_keytab_princ: Trying to authenticate for SQUIDPROXY-K$ from local keytab...
 -- try_machine_keytab_princ: Error: krb5_get_init_creds_keytab failed (Unsupported key table format version number)
 -- try_machine_keytab_princ: Authentication with keytab failed
 -- try_machine_keytab_princ: Trying to authenticate for host/routerdr from local keytab...
 -- try_machine_keytab_princ: Error: krb5_get_init_creds_keytab failed (Client not found in Kerberos database)
 -- try_machine_keytab_princ: Authentication with keytab failed
 -- try_machine_password: Trying to authenticate for SQUIDPROXY-K$ with password.
 -- create_default_machine_password: Default machine password for SQUIDPROXY-K$ is squidproxy-k
 -- try_machine_password: Error: krb5_get_init_creds_keytab failed (Preauthentication failed)
 -- try_machine_password: Authentication with password failed
 -- try_user_creds: Checking if default ticket cache has tickets...
 -- finalize_exec: Authenticated using method 4

 -- ldap_connect: Connecting to LDAP server: acdc.progresscall.al try_tls=YES
 -- ldap_connect: Connecting to LDAP server: acdc.progresscall.al try_tls=NO
SASL/GSSAPI authentication started
Error: ldap_sasl_interactive_bind_s failed (Local error)
        additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Server not found in Kerberos database)
Error: ldap_connect failed
--> Is your kerberos ticket expired? You might try re-"kinit"ing.
--> Is DNS configured correctly? You might try options "--server" and "--no-reverse-lookups".
 -- ~KRB5Context: Destroying Kerberos Context
  • What is the output of kinit administrator and klist? – Diamant Mar 1 '16 at 15:09
  • Those are ok. 'kinit administrator' doesn't give any output after i type the password (which means it's ok), 'klist' : Ticket cache: FILE:/tmp/krb5cc_0 Default principal: Administrator@DOMAIN.COM Valid starting Expires Service principal 03/01/2016 16:35:47 03/02/2016 02:35:47 krbtgt/DOMAIN.COM@DOMAIN.COM renew until 03/02/2016 16:35:43 – Edvin7 Mar 1 '16 at 15:35
  • is that a typing mistake, the line started with #[logging] in krb5.conf? You need to comment the following lines too (the whole block). – Diamant Mar 1 '16 at 15:39
  • or remove the #, from the [logging], if you want to keep it. But now you have misconfigured krb5.conf. – Diamant Mar 1 '16 at 15:47
  • I've uncommented the line [logging] and still gives this error. ... -- try_machine_keytab_princ: Trying to authenticate for SQUIDPROXY-K$ from local keytab... -- try_machine_keytab_princ: Error: krb5_get_init_creds_keytab failed (Unsupported key table format version number) ...Error: ldap_sasl_interactive_bind_s failed (Local error) additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database) Error: ldap_connect failed – Edvin7 Mar 1 '16 at 16:09
0

There is another way to get Squid integrated with AD - by not joining the machine to AD but by mapping the AD user to principal name of Squid. This seems to be simpler - see http://docs.diladele.com/administrator_guide_4_3/active_directory/install_prerequisites_for_kerberos_authentication.html#prepare-a-user-in-example-lan-domain-to-be-used-by-squid-for-kerberos-authentication

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.